CVE-2023-1385

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services.

This issue affects:

Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS 7.6.3.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-330

Affected software

VendorProductVersions
AmazonFire TV Stick 3rd gen6.2.9.4
InsigniaTV with FireOS 7.6.3.2

References

Timeline

Published
May 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-13867.8A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file wiCVE-2023-13877.5Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced the ability to searcCVE-2023-13888.1A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory CVE-2023-13898.8TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form oCVE-2023-13907.5A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknCVE-2023-13919.8A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is CVE-2023-13929.8A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerabilityCVE-2023-13937.8A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys thCVE-2023-13949.8A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the functionCVE-2023-13956.1A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been declared as problematic. This vulnerability affeCVE-2023-13966.1A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affecCVE-2023-13976.1A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown func
CVE-2023-1385: High severity, CVSS 8.8 | Vulnix